Executive brief
The vhost subsystem in the Linux kernel contains a logic error in how it tracks available buffer entries from guest virtual machines. When vhost networking is used with merged buffers, the incorrect logic causes the host to enter a livelock—continuously disabling and re-enabling notifications without making progress—if a guest stops producing new work. This can freeze network I/O for affected virtual machines.
Technical details
The vulnerability is a logic error in the vhost_get_avail_idx() function in drivers/vhost/vhost.c. The function is supposed to report whether new entries have been added to the available ring (by comparing the freshly-read avail_idx against the cached vq->avail_idx), but instead it was reporting whether all entries had been consumed (by comparing against vq->last_avail_idx). When vhost/net.c with mergeable buffers cannot immediately accept a packet due to insufficient combined buffer size, it re-enables notifications while entries remain available, causing vhost_enable_notify() to receive an incorrect return value and enter a tight loop of disabling/retrying. The root cause traces to commits d3bb267bbdcb and 7ad472397667, which changed the comparison logic. The fix updates vhost_get_avail_idx() to correctly compare avail_idx against the previously cached vq->avail_idx value before updating it, ensuring it reports only when genuinely new entries are present. Patches are available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel multiple versions (2.6.x–6.x including stable and rolling branches)
Timeline
- 2026-08-15: disclosed
- 2026-03-02: patched: Fix commit 09861858a68342f851f71c669ac0f69865c32151 by Michael S. Tsirkin